Upwind
Overview
Upwind Security is a cloud-native security platform providing runtime threat detection, vulnerability management, and risk prioritization for cloud environments (AWS, Azure, GCP, Kubernetes). The integration collects detections raised by Upwind and forwards them to Sekoia.io.
- Vendor: Upwind
- Supported environment: SaaS
- Detection based on: Alerts
- Supported application or feature:
- Detections
Configure
Prerequisite
To set up the integration, you need access to the Upwind console with permissions to manage credentials, as well as your Upwind Organization ID.
The Upwind API uses OAuth 2.0 with the client credentials grant. You must generate client credentials (a Client ID and Client Secret) that Sekoia.io will use to obtain an access token and call the API.
Generate client credentials
- Log into the Upwind console.
- Go to
Settings>Credentials. - Click the
Generate Credentialbutton. - Choose
APIas the credential type and give the credential a friendly name (or keep the auto-generated one). - Assign the permissions (scope and roles) required to read detections. You can mirror the permissions of an existing member group or define a custom scope and roles. Credentials can never exceed your own access levels.
- Click
Generate, then clickSavein the bottom right-hand corner. - Copy the
Client IDandClient Secret. The secret is only displayed once, so store it securely. - Note your
Organization IDfrom the organization settings.
For more details, refer to the Credentials page in the Upwind documentation.
Note
Access tokens automatically expire after 24 hours. The Sekoia.io connector requests a new token as needed using the client credentials, so no manual token rotation is required.
Select the correct region
Upwind exposes regional API endpoints. The Base URL you configure must match the region of your Upwind organization:
- US:
https://api.upwind.io - EU:
https://api.eu.upwind.io - ME:
https://api.me.upwind.io
An access token is only valid for the region it was issued for and cannot be used across regions.
Create your intake
Go to the intake page and create a new intake from the format Upwind.
When configuring the connector, provide the following information:
- Base URL: base URL of the Upwind API matching your region (
https://api.upwind.iofor US,https://api.eu.upwind.iofor EU,https://api.me.upwind.iofor ME) - Auth URL: OAuth2 token endpoint (default
https://auth.upwind.io/oauth/token) - Client ID: the OAuth2 client ID created above
- Client Secret: the OAuth2 client secret created above
- Organization ID: your Upwind organization ID
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
{
"id": "uwd-22222222222222bb",
"type": "custom_api_security",
"category": "API_SECURITY",
"severity": "CRITICAL",
"status": "OPEN",
"title": "OWASP API10:2023 XML External Entity (XXE) Injection Detected",
"description": "An XML input at `/rest/api/content/macro/preview` containing external entity references was detected.",
"resource": {
"id": "ep-bbbbbbbbbbbb0002",
"name": "hostname",
"type": "KUBERNETES_DEPLOYMENT",
"region": "ap-southeast-1",
"namespace": "app-stage",
"cloud_provider": "AWS",
"cluster_id": "00000000-0000-0000-0000-000000000001",
"cloud_account_id": "222222222222"
},
"links": [
{
"rel": "SELF",
"href": "https://api.example.com/v1alpha1/detections/uwd-22222222222222bb"
},
{
"rel": "VIEW",
"href": "https://console.example.com/threats?sidePanelItemId=uwd-22222222222222bb"
}
],
"triggers": [
{
"events": []
}
],
"first_seen_time": "2026-01-31T03:03:11Z",
"last_seen_time": "2026-02-16T09:06:02Z",
"occurrence_count": 33,
"mitre_attacks": [
{
"links": [
{
"rel": "TACTIC",
"href": "https://attack.mitre.org/tactics/TA0001"
},
{
"rel": "TECHNIQUE",
"href": "https://attack.mitre.org/techniques/T1190"
}
],
"tactic_id": "TA0001",
"tactic_name": "Initial Access",
"technique_id": "T1190",
"technique_name": "Exploit Public-Facing Application"
}
],
"upwind_console_link": "https://console.example.com/threats?sidePanelItemId=uwd-22222222222222bb",
"metadata": {
"vendor_name": "UPWIND_SECURITY"
}
}
{
"id": "uwd-11111111111111aa",
"type": "aws_cloudtrail_security_group_allow_traffic_to_all_ports",
"category": "CLOUD_TRAIL",
"severity": "MEDIUM",
"status": "OPEN",
"title": "A security group inbound rule was modified by assumed role to allow unrestricted traffic (0.0.0.0/0) for all ports",
"description": "Allowing unrestricted inbound access (0.0.0.0/0) to all ports exposes the cloud environment to the entire internet, creating a critical security vulnerability.",
"resource": {
"id": "ep-aaaaaaaaaaaa0001",
"name": "hostname",
"type": "AWS_SECURITY_GROUP",
"cloud_provider": "AWS",
"cloud_account_id": "111111111111"
},
"links": [
{
"rel": "SELF",
"href": "https://api.example.com/v1/organizations/org-test/threat-detections/uwd-11111111111111aa"
},
{
"rel": "VIEW",
"href": "https://console.example.com/threats?sidePanelItemId=uwd-11111111111111aa"
}
],
"triggers": [
{
"events": [
{
"type": "AWS_CLOUDTRAIL_EVENT",
"description": "Detection of suspicious AWS CloudTrail event",
"timestamp": "2026-03-17T11:58:50Z",
"initiator": {
"name": "John.Doe@example.com",
"type": "AssumedRole",
"principalId": "AROAAAAAAAAAAAAAAAAAA:John.Doe@example.com",
"arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_PowerUser/John.Doe@example.com",
"accountId": "123456789012",
"accessKeyId": "ASIAAAAAAAAAAAAAAAAAAA"
},
"endpointId": "ep-aaaaaaaaaaaa0001"
}
],
"policy_id": "dp-test-policy-0001",
"policy_name": "cloudtrail network change"
}
],
"first_seen_time": "2026-03-17T11:58:50Z",
"last_seen_time": "2026-03-17T11:58:50Z",
"occurrence_count": 1,
"mitre_attacks": [
{
"links": [
{
"rel": "TACTIC",
"href": "https://attack.mitre.org/tactics/TA0005"
},
{
"rel": "TECHNIQUE",
"href": "https://attack.mitre.org/techniques/T1578"
}
],
"tactic_id": "TA0005",
"tactic_name": "Defense Evasion",
"technique_id": "T1578",
"technique_name": "Modify Cloud Compute Infrastructure"
}
],
"upwind_console_link": "https://console.example.com/threats?sidePanelItemId=uwd-11111111111111aa",
"metadata": {
"vendor_name": "UPWIND_SECURITY"
}
}
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
No related built-in rules was found. This message is automatically generated.
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
AWS CloudTrail logs |
Upwind Security correlates AWS CloudTrail events to detect suspicious cloud activity |
Application logs |
Upwind Security generates threat detection alerts from cloud and Kubernetes runtime telemetry |
Network intrusion detection system |
Upwind Security detects API security threats and network-level anomalies |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | alert |
| Category | intrusion_detection |
| Type | info |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "{\"id\":\"uwd-22222222222222bb\",\"type\":\"custom_api_security\",\"category\":\"API_SECURITY\",\"severity\":\"CRITICAL\",\"status\":\"OPEN\",\"title\":\"OWASP API10:2023 XML External Entity (XXE) Injection Detected\",\"description\":\"An XML input at `/rest/api/content/macro/preview` containing external entity references was detected.\",\"resource\":{\"id\":\"ep-bbbbbbbbbbbb0002\",\"name\":\"hostname\",\"type\":\"KUBERNETES_DEPLOYMENT\",\"region\":\"ap-southeast-1\",\"namespace\":\"app-stage\",\"cloud_provider\":\"AWS\",\"cluster_id\":\"00000000-0000-0000-0000-000000000001\",\"cloud_account_id\":\"222222222222\"},\"links\":[{\"rel\":\"SELF\",\"href\":\"https://api.example.com/v1alpha1/detections/uwd-22222222222222bb\"},{\"rel\":\"VIEW\",\"href\":\"https://console.example.com/threats?sidePanelItemId=uwd-22222222222222bb\"}],\"triggers\":[{\"events\":[]}],\"first_seen_time\":\"2026-01-31T03:03:11Z\",\"last_seen_time\":\"2026-02-16T09:06:02Z\",\"occurrence_count\":33,\"mitre_attacks\":[{\"links\":[{\"rel\":\"TACTIC\",\"href\":\"https://attack.mitre.org/tactics/TA0001\"},{\"rel\":\"TECHNIQUE\",\"href\":\"https://attack.mitre.org/techniques/T1190\"}],\"tactic_id\":\"TA0001\",\"tactic_name\":\"Initial Access\",\"technique_id\":\"T1190\",\"technique_name\":\"Exploit Public-Facing Application\"}],\"upwind_console_link\":\"https://console.example.com/threats?sidePanelItemId=uwd-22222222222222bb\",\"metadata\":{\"vendor_name\":\"UPWIND_SECURITY\"}}",
"event": {
"category": [
"intrusion_detection"
],
"dataset": "api_security",
"end": "2026-02-16T09:06:02Z",
"kind": "alert",
"reason": "An XML input at `/rest/api/content/macro/preview` containing external entity references was detected.",
"severity": 4,
"start": "2026-01-31T03:03:11Z",
"type": [
"info"
],
"url": "https://console.example.com/threats?sidePanelItemId=uwd-22222222222222bb"
},
"@timestamp": "2026-01-31T03:03:11Z",
"cloud": {
"account": {
"id": "222222222222"
},
"instance": {
"id": "ep-bbbbbbbbbbbb0002",
"name": "hostname"
},
"provider": "aws"
},
"host": {
"id": "ep-bbbbbbbbbbbb0002",
"name": "hostname"
},
"log": {
"syslog": {
"severity": {
"name": "CRITICAL"
}
}
},
"observer": {
"product": "Upwind",
"type": "cloud",
"vendor": "Upwind Security"
},
"threat": {
"framework": "MITRE ATT&CK",
"tactic": {
"id": "TA0001",
"name": "Initial Access"
},
"technique": {
"id": "T1190",
"name": "Exploit Public-Facing Application"
}
},
"upwind": {
"console_link": "https://console.example.com/threats?sidePanelItemId=uwd-22222222222222bb",
"detection": {
"category": "API_SECURITY",
"occurrences": 33,
"resource": {
"type": "KUBERNETES_DEPLOYMENT"
},
"status": "OPEN",
"title": "OWASP API10:2023 XML External Entity (XXE) Injection Detected",
"type": "custom_api_security"
}
}
}
{
"message": "{\"id\":\"uwd-11111111111111aa\",\"type\":\"aws_cloudtrail_security_group_allow_traffic_to_all_ports\",\"category\":\"CLOUD_TRAIL\",\"severity\":\"MEDIUM\",\"status\":\"OPEN\",\"title\":\"A security group inbound rule was modified by assumed role to allow unrestricted traffic (0.0.0.0/0) for all ports\",\"description\":\"Allowing unrestricted inbound access (0.0.0.0/0) to all ports exposes the cloud environment to the entire internet, creating a critical security vulnerability.\",\"resource\":{\"id\":\"ep-aaaaaaaaaaaa0001\",\"name\":\"hostname\",\"type\":\"AWS_SECURITY_GROUP\",\"cloud_provider\":\"AWS\",\"cloud_account_id\":\"111111111111\"},\"links\":[{\"rel\":\"SELF\",\"href\":\"https://api.example.com/v1/organizations/org-test/threat-detections/uwd-11111111111111aa\"},{\"rel\":\"VIEW\",\"href\":\"https://console.example.com/threats?sidePanelItemId=uwd-11111111111111aa\"}],\"triggers\":[{\"events\":[{\"type\":\"AWS_CLOUDTRAIL_EVENT\",\"description\":\"Detection of suspicious AWS CloudTrail event\",\"timestamp\":\"2026-03-17T11:58:50Z\",\"initiator\":{\"name\":\"John.Doe@example.com\",\"type\":\"AssumedRole\",\"principalId\":\"AROAAAAAAAAAAAAAAAAAA:John.Doe@example.com\",\"arn\":\"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_PowerUser/John.Doe@example.com\",\"accountId\":\"123456789012\",\"accessKeyId\":\"ASIAAAAAAAAAAAAAAAAAAA\"},\"endpointId\":\"ep-aaaaaaaaaaaa0001\"}],\"policy_id\":\"dp-test-policy-0001\",\"policy_name\":\"cloudtrail network change\"}],\"first_seen_time\":\"2026-03-17T11:58:50Z\",\"last_seen_time\":\"2026-03-17T11:58:50Z\",\"occurrence_count\":1,\"mitre_attacks\":[{\"links\":[{\"rel\":\"TACTIC\",\"href\":\"https://attack.mitre.org/tactics/TA0005\"},{\"rel\":\"TECHNIQUE\",\"href\":\"https://attack.mitre.org/techniques/T1578\"}],\"tactic_id\":\"TA0005\",\"tactic_name\":\"Defense Evasion\",\"technique_id\":\"T1578\",\"technique_name\":\"Modify Cloud Compute Infrastructure\"}],\"upwind_console_link\":\"https://console.example.com/threats?sidePanelItemId=uwd-11111111111111aa\",\"metadata\":{\"vendor_name\":\"UPWIND_SECURITY\"}}",
"event": {
"category": [
"intrusion_detection"
],
"dataset": "cloud_trail",
"end": "2026-03-17T11:58:50Z",
"kind": "alert",
"reason": "Allowing unrestricted inbound access (0.0.0.0/0) to all ports exposes the cloud environment to the entire internet, creating a critical security vulnerability.",
"severity": 2,
"start": "2026-03-17T11:58:50Z",
"type": [
"info"
],
"url": "https://console.example.com/threats?sidePanelItemId=uwd-11111111111111aa"
},
"@timestamp": "2026-03-17T11:58:50Z",
"cloud": {
"account": {
"id": "111111111111"
},
"instance": {
"id": "ep-aaaaaaaaaaaa0001",
"name": "hostname"
},
"provider": "aws"
},
"host": {
"id": "ep-aaaaaaaaaaaa0001",
"name": "hostname"
},
"log": {
"syslog": {
"severity": {
"name": "MEDIUM"
}
}
},
"observer": {
"product": "Upwind",
"type": "cloud",
"vendor": "Upwind Security"
},
"related": {
"user": [
"John.Doe@example.com"
]
},
"rule": {
"id": [
"dp-test-policy-0001"
],
"name": [
"cloudtrail network change"
]
},
"threat": {
"framework": "MITRE ATT&CK",
"tactic": {
"id": "TA0005",
"name": "Defense Evasion"
},
"technique": {
"id": "T1578",
"name": "Modify Cloud Compute Infrastructure"
}
},
"upwind": {
"console_link": "https://console.example.com/threats?sidePanelItemId=uwd-11111111111111aa",
"detection": {
"category": "CLOUD_TRAIL",
"initiator": {
"id": [
"AROAAAAAAAAAAAAAAAAAA:John.Doe@example.com"
],
"name": [
"John.Doe@example.com"
]
},
"occurrences": 1,
"resource": {
"type": "AWS_SECURITY_GROUP"
},
"status": "OPEN",
"title": "A security group inbound rule was modified by assumed role to allow unrestricted traffic (0.0.0.0/0) for all ports",
"type": "aws_cloudtrail_security_group_allow_traffic_to_all_ports"
}
},
"user": {
"id": [
"AROAAAAAAAAAAAAAAAAAA:John.Doe@example.com"
],
"name": [
"John.Doe@example.com"
]
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
cloud.account.id |
keyword |
The cloud account or organization id. |
cloud.instance.id |
keyword |
Instance ID of the host machine. |
cloud.instance.name |
keyword |
Instance name of the host machine. |
cloud.provider |
keyword |
Name of the cloud provider. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.dataset |
keyword |
Name of the dataset. |
event.end |
date |
event.end contains the date when the event ended or when the activity was last observed. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.start |
date |
event.start contains the date when the event started or when the activity was first observed. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
event.url |
keyword |
Event investigation URL |
host.id |
keyword |
Unique host id. |
host.name |
keyword |
Name of the host. |
log.syslog.severity.name |
keyword |
Syslog text-based severity of the event. |
observer.product |
keyword |
The product name of the observer. |
observer.type |
keyword |
The type of the observer the data is coming from. |
observer.vendor |
keyword |
Vendor name of the observer. |
rule.id |
keyword |
Rule ID |
rule.name |
keyword |
Rule name |
threat.framework |
keyword |
Threat classification framework. |
threat.tactic.id |
keyword |
Threat tactic id. |
threat.tactic.name |
keyword |
Threat tactic. |
threat.technique.id |
keyword |
Threat technique id. |
threat.technique.name |
keyword |
Threat technique name. |
upwind.console_link |
keyword |
Direct link to the detection in the Upwind console |
upwind.detection.category |
keyword |
Category of the detection (e.g. API_SECURITY) |
upwind.detection.initiator.id |
keyword |
Id(s) of the initiator(s) of the detected event |
upwind.detection.initiator.name |
keyword |
Name(s) of the initiator(s) of the detected event |
upwind.detection.occurrences |
long |
Number of times this detection has been observed |
upwind.detection.resource.type |
keyword |
Detection resource type (e.g. KUBERNETES_DEPLOYMENT) |
upwind.detection.status |
keyword |
Detection status (e.g. OPEN, CLOSED) |
upwind.detection.title |
keyword |
Human-readable detection title |
upwind.detection.type |
keyword |
Machine-readable detection type identifier (e.g. aws_cloudtrail_security_group_allow_traffic_to_all_ports) |
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.